Privacy

In the app we call a workspace a bullpen; the two words mean the same thing below.

• We collect what team chat needs to work: your email, your handle, the messages you write and the files you attach.
• No ads. We do not sell or share your data. Visit counts on this site go to Vercel Web Analytics — the host that already serves the pages — not to an ad network or a third-party tracker.
• Voice recording is the sensitive one. It only runs when a member starts it, it shows an indicator to everyone in the room, and the audio is stored and transcribed by a third party.
• Messages an AI helper is shown are sent to a model provider to produce the reply. Never your DMs when you ask from a channel. Those requests go only to AI services that promise not to keep them or train on them. Web search and PDF reading are the two exceptions, named below. Three AI helpers also work without being asked — link summaries, promise reminders and a Friday recap — unless the bullpen's owner or an admin switches them off.
• Ace, your assistant, reads what you can read, for you alone. When you ask it something, it reads what you can open across all your bullpens: channels, your own direct messages, files, reminders, and who is in them. That goes to the same AI service the AI helpers use, under the same rules. No bullpen owner or admin can see it, your conversations with it, or what it costs.
• Stripe handles payments. We never see a card number.
• Deleting your account removes your profile and message text. Other people's replies remain, with deleted-message placeholders where your writing used to be. It also cancels Ace.

Your account. Email address, the username you pick, and your display name. Passwords are handled by our auth provider and hashed there — we never see or store one. Used to sign you in and to show teammates who you are. If you arrived from an ad or a link carrying campaign tags (utm_…, gclid, fbclid and the like), those tags are kept on the account you create, so we can tell which campaign brought you in. They are never shown to teammates and never sent to the ad platform.

Your agreement to these pages. When you agree to the Terms and this Privacy Policy, we write down one record. It holds your account id, a hash of your email address (never the address itself, though anyone who already knows the address can check it against the hash — that is how we find your records when you write to us), the Terms version and the Privacy version you agreed to, whether you confirmed you are 13 or older and when you ticked it, when we recorded it, how you agreed (signing up on the web or in the iPhone app, or agreeing again after a change), a hash of your network address (never the address itself), and your browser's or app's identifying string, cut to 200 characters. A new record is added each time you agree to a new version. Records made before September 30, 2026 scrambled the network address without a secret key, which makes that hash easier to work back to the address; records since then use one. These records are kept after you delete your account, on purpose, so we can show that an account agreed to a specific version. They are not used for advertising or to build a profile of you.

What you write. Messages, the files attached to them, channel and room names, workspace names, who is a member of what, invites, reactions, and which messages you have read. That is the product; without it there is nothing to open.

Voice presence. While you are in a room, which room and whether your mic is muted, so the rail can show it. That is live state and disappears when the call does. The one thing it leaves behind is a usage record — see below.

Recordings, only when one is started. Per-speaker audio from the room, the transcript made from it, and the notes posted afterwards. See Voice rooms and recording below, which is the section worth reading properly.

Usage and cost. One row per billable unit per workspace: what kind of thing ran (an AI helper reply, a voice minute, a transcription), roughly how many tokens, and what it cost. A row can also name the channel, the person and the AI helper it belongs to — a voice minute is one row per participant per minute, so those rows do amount to a record of who was in which room. It is how we know what running your workspace costs, how the monthly usage allowance is enforced, and workspace admins can read the same meter in the app.

Ace, if you use it. Each answer it gives you is written down as one row with what it cost. That row is on your own usage, not a workspace's: it is on no bullpen's meter, no admin can see it, and only you are shown how much of your usage is left.

Ace's note about you. Ace keeps a short note about you — your role, your projects, how you write — so its answers fit you. About once a week it rewrites the note from your recent questions and its answers (up to the last 20 since the note was last written). That rewrite goes to the same AI service under the same two settings described below. The note is on until you switch off Let Ace remember things about you; then it is not rewritten and not used. You can read it, and erase it with Forget everything.

Ace keeps your conversations with it. Your questions and its answers are kept in your own conversations in Home until you delete a conversation or your account. Nobody else can open them — no bullpen owner or admin. Under each answer it keeps the list of places it looked, in plain words ("Searching Northwind for Rook", "Reading payroll.xlsx"), and how long it took. Only you are shown that list, and it is deleted with the answer or the account. A file it makes for you is stored in your conversation like any attachment.

Ace's settings. How hard Ace thinks (the Thinking setting), whether it writes you a daily brief, and whether it keeps a note about you are stored on your account.

Billing details, held mostly by Stripe. If your workspace buys a plan, Stripe collects the card, the billing address and any VAT number. We store the Stripe customer id, the subscription id, the plan and the interval on the workspace row — see Paying for a plan.

Push notifications, only if you turn them on. Switching the bell on stores the push address your browser or phone hands us and the keys that let that service relay bytes it cannot read. A message push names the channel and nothing else. A voice call push names who is calling, because a ringing phone has to say who it is. Turning the bell off deletes the row. On the iPhone app, Apple gives the app a device token instead. We store that token, which account is signed in on that handset, which Apple push environment issued it, the app version and when we last saw it. Deleting your account deletes the row, and so does signing out of that phone.

Visit counts. The marketing pages and the signed-in app send page views and a handful of named conversion events to Vercel Web Analytics, which runs on this same deployment. A page view carries the path, the referrer, and any UTM campaign tags on the URL. Conversion events are named (signup_started, signup_completed, pricing_clicked, pricing_cta) and carry no email, no handle, and no message content. One-time tokens in a sign-in link are stripped from the URL before the view is sent. This is how we count whether a campaign brought someone who then signed up; it is not an advertising profile.

Cookies, and only these. A session cookie from our auth provider (names beginning sb-), a cookie remembering which workspace you last had open, and a cookie recording that you finished first-run setup. Your browser also keeps, in its own storage under a bullpen: prefix, unsent drafts (Ace's unsent questions only for as long as the tab is open), read positions, the last bullpen you had open, and display, sound and notification preferences. The cookies and everything under that prefix are cleared when you sign out. A few settings about this device rather than your account stay after sign-out: how you like to join a voice room, voice mode and which speaker to use. Campaign tags from the link you arrived by are kept for the tab only and go when it closes. None of them are for advertising or for tracking you across other sites. Visit counts do not use a cookie.

Where you're signed in. One row per sign-in session: a device label worked out from your browser's user-agent ("Chrome on macOS"), the first three parts of your network address rather than the whole one, the city and country our edge already knows the request came from ("Austin, TX, US"), and when that session was first and last seen. It is what the list in Account settings draws, and it exists so you can notice a session that is not yours and end it. We never store the whole address. We do not ask any third party where you are, either — the city is a header the network in front of us had already attached to the request.

Message reports. If you report a message, we store your account ID, a reference to the message, the workspace and channel it was in, the account ID of the person who wrote it, your chosen reason, any details you provide, and the review status. We do not copy the original message into the report.

Who reads a report. The admins and owner of the bullpen the message was in review it. They see the reported message in the conversation it was in, your chosen reason and the details you typed. Admins are not shown your name. Their screen says "A member reported this". Which account filed a report stays in our database, where only we can see it. You stay anonymous to the person you reported. They are never shown the report, your name, your reason or your details; if their message is hidden they are told that it was reported and that an admin is looking at it, and nothing else.

An automatic first reading. When a message is reported, the text of that message, the file names attached to it, up to eight earlier messages from the same channel (up to four in a direct conversation), your chosen reason and your details are sent once to our AI provider, which returns a short opinion for the admins to read. The opinion is stored on the report. It cannot suspend or remove anybody. The heaviest thing it can cause on its own is that one message is hidden from other people — reversibly, with the workspace's admins told immediately. See the Terms for what admins can then do.

Your record as a reporter. Within one workspace, we count how many of your reports in the last 90 days were upheld and how many were dismissed. It is used for one thing: deciding how much weight a report carries towards hiding a message automatically. It is never shown to admins, never carried between workspaces, and never used to restrict your account.

Posting pauses. If an account posts in a way that matches our bulk-posting rules inside one workspace — a burst of messages in under a minute, the same message repeatedly, repeated link-only messages to one site, or repeated messages to everyone — we store that workspace, that account, which rule matched, and a time until which posting is refused. The pause is 30 seconds, 5 minutes, 1 hour or 24 hours and goes no higher; it resets after seven quiet days. It never removes or suspends anybody, and it is based on how often messages were posted, not on what they said.

Blocked people. We store the two account IDs, your block preference and when it changed to restrict direct contact and hide messages between those accounts. Only you can read your block list through the app. Unblocking stops your restriction but does not restore a friendship. These preferences, including prior choices, are removed when either account is deleted. Blocking does not erase shared recordings or material other people have quoted.

Security log. When something happens that matters for keeping an account or a bullpen safe, we write down one row. That covers deleting or handing over a bullpen, removing a member or changing a role, a removed person trying to rejoin, making or cancelling an invite, a plan change, a password change, ending a session, downloading a copy of your account, a wrong code at an email check, and deleting an account. Each row says what happened, when, in which bullpen, and who did it. It also keeps a shortened network address (never the whole address), the kind of device, and the city or region the request came from. The owner and admins of a bullpen can read its rows. We keep this log so we can look into break-ins and misuse.

Getting-started records. When you sign up, start a bullpen, invite somebody, join a bullpen, or a bullpen's AI helpers answer for the first time, we write down one row: which of those it was, when, and the account and bullpen it was about. They hold nothing anybody typed. We use them to count how many people get as far as a working bullpen. Nobody in any bullpen can read them.

Server logs. Our hosting provider keeps ordinary request logs, which include IP addresses, the way every web host does. Browser security-policy violation reports come to us as a capped log line and are never written to a database.

Crash reports. When JavaScript throws in your browser, the page sends us the error message, up to three lines of the stack, the path of the page you were on, and your browser's user-agent string. The query string is thrown away before anything is logged, so the workspace and channel ids in an /app URL — and the token in a sign-in link — never reach us this way. Those four things, plus which build of Bullpen you were on, are written down as one row in our own database, kept for about 30 days so we can find the bug, then deleted. A scheduled job deletes rows older than 30 days, so it happens whether or not anyone remembers. Your name and account id are not attached to a report from your browser. An error on our own servers is written to the same table; when it happened while handling a payment of yours, that row carries your account id, so we can find what went wrong for you. It never leaves this deployment apart from one thing: when more than five errors land in a minute, we email ourselves a short alert through Resend carrying the last five error lines — the path of the page and the message — so a bad minute reaches us without anyone having to be watching. There is no error-reporting service behind any of it, and only we can read the table. It is used to find bugs and nothing else. If a bug puts a piece of what you typed into an error message, that fragment rides along in the message — into the row, and into that alert if it landed in a bad minute; we are telling you rather than pretending the field is always machine text.

• No advertising, and nothing about you is used to target one.
• We do not sell, rent, share or trade your data — not to a data broker, not to anyone. In the sense California law gives those words, we do not sell or share personal information, and we have not in the past twelve months.
• We do not train models on your content. The requests we send to AI models are set so the provider may not keep them or train on them. That setting covers model requests only; the AI helpers section says exactly what it does not cover.
• No advertising analytics and no tracking pixels. We checked rather than assumed: there is no Google Analytics, Tag Manager or Meta pixel, no PostHog, Mixpanel, Amplitude, Segment, Hotjar or Plausible, and no Sentry or Datadog anywhere in this app. Nothing follows you onto other sites.
• We do not read your workspace for fun. Support access happens when you ask for help, and we say so when it does.

There is no longer an exception to "no third-party requests". The home page used to load its two typefaces from Google Fonts, which meant Google saw a request from anyone who opened it. It now serves those typefaces from this site, the way the signed-in app always has, so opening the home page contacts nobody but us. Visit counts stay on this host too — they post to a same-origin /_vercel/insights path rather than to an analytics vendor. Crash reports are a different thing and are described above. The signed-in app reaches the services in who else processes your data and nothing outside that list.

A voice room is live audio carried by LiveKit. In a call that nobody records, no audio file and no transcript are created. While you are in a room the app records a usage row a minute against your workspace, and that row names the channel and you. Those rows are a record of who was in which room and for how long — see what we collect.

We also keep a private record of the room permissions issued to your account, without storing the access tokens or audio. When your account is deleted, those room IDs move into a cleanup queue so we can end existing calls and revoke cached room access. We try immediately and retry failed requests on our five-minute cleanup schedule. Provider outages or a backlog can delay disconnection. The queue records are removed after the provider confirms revocation.

Recording only starts when a member presses "Ask Wren to take notes". There is no always-on capture, and no path that starts one without raising the indicator below. While a session runs:

"Join without being recorded" is a real choice. Our server marks your place in the room. You cannot remove the mark, and the recorder skips anyone who carries it. It lasts until you leave the room. Its limits, stated plainly:

• People already in the room when notes start are not asked first. To stay out of that session they can only leave the room or mute their microphone.
• Somebody who joins after notes have started is not captured in that session, whichever way they join. Nor is somebody whose microphone is off at the moment notes start, even if they turn it on later.

Here is exactly what happens to that audio:

• LiveKit captures one file per speaker, so the transcript can say who said what. If a speaker's camera is on, their video is in that file too, and it travels with the sound to transcription; only what is said is written down. People who join after the session starts are not captured.
• Those files are written to our private object storage on Supabase. The bucket is not public; our server reads a file with a signed request, and no browser ever gets a link to one.
• The file is sent to a speech-capable model — currently Google's Gemini, reached through OpenRouter and served from Google Vertex — which returns the words. The same no-training, no-retention settings as AI helper replies apply; see AI helpers and model providers.
• The transcript is stored with the session and is accessible only to our server. An OpenAI model, reached the same way, reads it and writes the notes. Wren posts decisions and action items in the selected channel, where people with access to that channel can read them.

Only the person who started the session or a workspace admin can stop it, so nobody else can silence a recording other people are relying on.

Whether recording a particular room is lawful is decided by where the people in it are, and that is on whoever starts the session — the Terms say so plainly. The indicator and the channel message exist so nobody is recorded secretly.

Recorded audio has no automatic age-based expiry today. It stays in that private bucket until we remove it. If you want a specific recording deleted, email support@bullpen.chat with the workspace and roughly when the meeting was, and we will delete it.

Deleting your account removes transcript segments attributed to you and queues your recorded tracks for deletion, including in shared meetings. Other people's original contributions remain. New meeting notes and reminders carry a private link to their source participants; a mixed generated note is removed as a whole when one of those participants deletes their account. Older notes without that link, and material copied by other people, may need separate review. Contact support@bullpen.chat for help with those records.

Deleting a room or workspace queues its recorded files before removing the session records. Cleanup retries storage failures and waits for the recorder to finish uploading. If the recording provider can no longer confirm its status, the cleanup record remains for review; deletion of stored audio is not necessarily immediate.

AI helpers answer on every plan, including Free. What follows happens whenever an AI helper actually replies, on any plan. It does not happen when a reply is refused — over the monthly allowance, or on a paid-only feature: that refusal is written by Bullpen, no prompt is built, and nothing about your workspace reaches a model provider.

When you mention an AI helper, we build a prompt and send it to a third-party large-language-model provider, reached through OpenRouter. Today that is OpenAI's models, served from Microsoft Azure, for AI helper replies, Ace's answers and writing meeting notes, and Google's Gemini, served from Google Vertex, for reading meeting audio. We name the category rather than a version number because the version changes more often than this page does.

What goes in that request:

• Recent message history from channels the person asking can already read — up to 200 messages, capped at roughly 32,000 characters, with the oldest dropped first.
• Older messages that match the question, pulled from the same set by full-text search, so an AI helper can answer about something that has scrolled away.
• A directory of the workspace as it currently is: channel names, room names, and the display names of members and AI helpers.
• The question itself, and the AI helper's instructions.
• On a paid plan, the files attached to the question. For a spreadsheet, document, slide deck or CSV file, that is its text. A PDF goes in full, and its text is read out by Cloudflare's PDF reader on the way. A picture goes as a short-lived private link the provider opens. When someone asks for a change to a file an AI helper made, that file's contents go too.

Files an AI helper makes are stored like any attachment. A spreadsheet, document, slide deck or PDF an AI helper makes is saved with its message, in the same private storage as the files people attach.

One request can also reach a web search engine. Only when a message begins @Scout search:, and only the rest of that message — the question, capped at 300 characters — goes to Exa, reached through OpenRouter. Channel history stays out of the search. The pages it returns are shown to the model the way messages are, and the reply cites them.

Direct messages are held out of both. An AI helper asked in a channel never receives the asker's DMs, and an AI helper asked inside a DM receives that DM and nothing else from the workspace. The scope is decided per question, because the answer is read by whoever can read the room it lands in.

Ace is the exception, and only for you. It is a personal helper a member turns on for themself, not an AI helper of any workspace. When you ask it something, it is shown what you can already open in Bullpen at that moment: the channels you are in, across every bullpen you belong to, and your own direct messages, plus its short note about you. It is never shown anything you could not open yourself. That goes to the same AI service the AI helpers use, under the same two settings described below. Its answers are shown to you alone, and no bullpen owner or admin can see them.

Ace looks further when you ask. While it answers, it can look further, as you, and only at what you can already open: messages by a person or an AI helper, the messages around one, a file attached to a message, your reminders and open promises, the member list of your bullpens, and what arrived since you last looked. Those go to the same AI service, under the same two settings. Apart from the daily brief below, nothing is read ahead of time. Nothing from those reads is kept, apart from the answer and the list of places it looked.

Ace's daily brief is the one read you do not ask for. Unless you switch it off in You → Ace, it reads once each morning, as you: what is due, your reminders, and unread messages that mention you. It writes one short message in your conversation from that, the same way it writes an answer.

What you tap leaves your conversation. Ace can get a message, a reminder, a file, or a hand-off to a bullpen AI helper ready for you, as a card. Nothing is posted, set, made or sent until you tap it. Then it is done as you, in the bullpen you chose, and from there it is like anything else you do in that bullpen: a message is read by the people in that channel, and a bullpen AI helper that replies is shown what any AI helper asked there would be.

What does not go: your password, your email address, your usage records, your billing details, or anything from a channel the asker cannot open.

The same applies to the daily standup digest, which is one scheduled AI helper call per workspace that has switched it on.

Things Bullpen notices on its own. Three AI helpers work in a bullpen's channels without anybody mentioning them. They never read direct messages. Each one is on unless the bullpen's owner or an admin switches it off in Bullpen settings → AI helpers → Automatic help. If you are not an admin, ask one of them.

• Link summaries, by Scout. When you share a web page in a channel, Bullpen fetches that page. Up to 6,000 characters of its text, your message (up to 700 characters), your name and the channel name go to the AI service. Scout then posts a short summary under your message. The page text is not stored. We keep a scrambled form of the link (a hash), so the same page is not summarised twice in one week.
• Promise reminders, by Nix. When a message you write in a channel reads like a promise with a day on it — "I'll send it Friday" — its text (up to 1,000 characters) and when you wrote it go to the AI service, which says whether it is a promise. If it is, we store what you promised, the date, and your time zone. Only you can see that note until the morning it is due. That morning Nix posts a "Due today" line in the channel, and from then on the channel can see it. The note is kept until you delete the message or your account.
• The Friday recap, by Wren, on paid plans. Once a week, Bullpen reads the week's messages in the bullpen's public channels. Private channels are never read. The unanswered questions of the week — at most forty, each cut to 300 characters, with the asker's name and the channel name — go to the AI service, which picks up to three that are still open. Wren posts the week's decisions, the files AI helpers made, and those questions in #general. The same lines are emailed to the bullpen's owner, and the email has a link that stops the emails while the recap still posts. We keep those lines until the bullpen is deleted.

Bullpen does not train models on your content. Every request we send to an AI model through OpenRouter — AI helper replies, Ace's answers, the first reading of a reported message, link summaries, promise reminders, the Friday recap, meeting transcription and meeting notes — carries two settings. One refuses any provider that collects the data or trains on it. The other allows only services with a zero-data-retention policy, meaning they keep none of it. Today that means OpenAI's models run on Microsoft Azure, and Gemini (meeting audio) runs on Google Vertex. If no service meets that bar, the request fails. It is never sent again without those settings.

What those settings do not cover. They apply to model requests only. Two other services can see part of a request, and each handles it under its own terms and its own retention, not ours:

• Exa, the web search behind @Scout search:. It sees the search question, up to 300 characters.
• Cloudflare, which reads the text out of a PDF attached to a question on a paid plan, or a PDF Ace opens for you. It sees the whole PDF.

OpenRouter, which passes each request on, also handles it under its own terms. That is a limit worth stating plainly rather than papering over.

AI helper answers can be wrong. That is a product fact rather than a privacy one, and the Terms say it at length.

Bullpen stores no card numbers. Buying a plan sends the workspace owner to Stripe's own checkout page, where Stripe collects the card, the billing address it needs to work out tax, and a VAT number if the business has one. None of that reaches our servers.

What Stripe is told about you is the workspace id, the plan and the interval, and — for a first purchase — the email address on your account, so the receipt has somewhere to go. For a refill or extra room for files, Stripe is also told your account id and which one you bought. What we keep afterwards is the Stripe customer id, the subscription id, the plan and the interval, on the workspace row.

Invoices, receipts, the card on file and cancellation live in Stripe's billing portal rather than in a screen we built, which is also why the payment history is Stripe's to keep. A cancelled workspace keeps its customer id so the portal still opens on its own invoices.

Ace is paid for by you, not by a workspace. You buy it yourself, on a computer, through Stripe's own checkout. Stripe is told your account id, not a workspace id, the tier and billing period you picked (Ace, Ace Plus or Ace Max, monthly or yearly), and — for a first purchase — the email address on your account, for the receipt. The Stripe customer id and subscription id are kept on your own record, separate from any bullpen's, with the plan's tier, its billing period, whether it is active and when it renews. Each refill you buy is recorded with how much usage it added. No bullpen owner or admin can see any of it.

Stripe is a processor for the parts it handles on our behalf and a controller for the parts it must keep for its own compliance. Its privacy notice governs those.

These companies handle your data on our behalf so that Bullpen can run. We do not add one without updating this list.

One more that is not a processor: when you turn browser notifications on, the push service your browser belongs to — Apple, Google or Mozilla — relays the message. It sees the endpoint and the encrypted bytes, and it cannot read them.

These are US companies, so assume your data is processed in the United States as well as anywhere else they operate.

If you are in the UK or the EEA, that is an international transfer, and the thing that makes it lawful is the mechanism in each provider's own data processing agreement rather than anything Bullpen adds on top. For every company in the list above that is one of two: the European Commission's Standard Contractual Clauses, or that provider's own certification under the EU-US Data Privacy Framework and its UK extension where it holds one. Which of the two applies is the provider's to state, and each of them publishes it. Bullpen itself is not certified under the Data Privacy Framework, has no EU or UK representative appointed, and does not yet have its own data processing agreement to countersign — if your organisation needs one, email support@bullpen.chat and we will tell you where that stands rather than send you a template.

We may also disclose data if the law requires it, or to protect somebody from serious harm. If Bullpen is ever sold or merged, the data moves with the service and this page changes before it does. That is the whole list.

If you are in a place with data-protection law, these are the grounds we rely on:

• To do what you asked — your account, your messages, your files, your voice rooms, your AI helpers, and Ace if you turn it on. Running the service you signed up for is the contract between us.
• Our legitimate interests — keeping the service up and secure, stopping abuse, metering what a workspace costs so the plan limits mean something, counting how people find the product so a campaign can be told from a coincidence, and keeping a record of which version of these pages each account agreed to. Nothing under this heading is used to profile you or to sell anything.
• Your consent — browser notifications, which the browser asks you for and you can withdraw by turning the bell off.
• A legal obligation — payment and tax records, which Stripe keeps for the period the law requires.

• Messages, files and channels are kept until they are deleted. There is no automatic expiry — chat history that vanishes on a timer is not what a team wants from one.
• Deleting a workspace cascades. It is a single operation: the workspace row goes and the database removes its channels, messages, memberships, AI helpers, invites, note-taking sessions and usage records with it. It either all happens or none of it does — there is no half-deleted workspace.
• Deleted attachments and replaced profile photos are queued for file removal when their database records change. Cleanup retries failed requests. Abandoned attachment and photo uploads become eligible after a day. The hourly scan resumes from its saved position and processes a limited batch, so eligible files may remain longer. A private hash of each retired file key prevents stale requests from reattaching it; the hash contains no file bytes or plaintext filename.
• Usage records survive smaller deletions on purpose. Removing a channel or a member does not erase what the workspace was billed for; the record stays and simply stops naming them. It still dies with the workspace.
• Ace's records — your plan for it goes when you delete your account. The row for each answer stays, with your name removed, the same as a workspace's usage rows. Its note about you stays until you erase it with Forget everything or delete your account; switching off the note stops it being rewritten or used. Your conversations with it, and the list of places it looked for each answer, stay until you delete the conversation or your account. Each morning's daily brief is deleted after about 30 days by a scheduled job; where you wrote back to a brief, the brief goes and your words stay.
• Recorded audio stays in private storage until we delete it — see the note in Voice rooms and recording.
• Push subscriptions go when you turn the bell off, and are pruned automatically once the push service says that browser is gone.
• Session records — the "where you're signed in" rows — live until you delete your account, at which point they go with your profile. They are not expired on a timer on purpose: a session last used months ago can still be live, and hiding it would hide the one you most need to see.
• Billing records live with Stripe under its retention policy and the tax law it answers to. What we hold is the handful of ids described above.
• Message reports remain for review and follow-up until we remove them or you delete your account. There is no automatic expiry. Deleting your account removes your submitted reports; deleting the reported message removes its reference but does not by itself delete the report's explanation.
• What Bullpen notices on its own — a promise note stays until you delete its message or your account. A Friday recap's lines stay until the bullpen is deleted. For a link summary we keep only a hash of the link, never the page.
• The security log has no automatic expiry. Deleting a bullpen or an account does not remove its rows. They stop linking to it, but an account id already written in a row stays.
• Acceptance records — which Terms and Privacy versions an account agreed to — are kept after the account is deleted, on purpose. See what we collect.
• Crash reports are kept for about 30 days and then deleted by a scheduled job, so the clear-out happens whether or not anyone remembers it. A bug nobody has looked at in a month is one this row will not help with.
• Visit counts follow our hosting provider's own retention for Web Analytics, which we do not set and do not control.
• Server logs follow our hosting provider's own retention policy, which we do not set and do not control.

Depending on where you live you may have the right to see the personal data we hold about you, correct it, take a copy of it, have it deleted, object to some uses of it, or complain to your data-protection authority. In California you also have the right not to be treated differently for exercising any of that. We honour those requests regardless of where you live, and we do not charge for them.

What you can do yourself right now:

• Change your display name and username in the app.
• Edit or delete messages you wrote.
• Leave a workspace.
• Turn browser notifications off, which deletes that row.
• Cancel a plan in the billing portal, if you own the workspace.
• Read Ace's note about you, erase it with Forget everything, or switch it off.
• Delete a conversation with Ace, or switch its daily brief off.
• Delete a workspace you own, which deletes everything in it for everybody.
• Export your data from Settings → Account.
• Delete your account from Settings → Account.

Export your data from Settings → Account. It is one file, built while you wait: your profile, the workspaces you are in, and every message you have written, direct messages included. Very large accounts are capped, and the file says so in itself and names the address that can send you the rest. Email support@bullpen.chat from the address on the account if you would rather we did it for you.

Delete your account from Settings → Account. You type your username, we ask you to confirm it is you by email, and then it is a real deletion — the next section says exactly what it removes. If you own a workspace that other people are in, we ask you to hand it over first, because a workspace with no owner is one nobody can rename, invite into or close. Email support@bullpen.chat if you would rather we did it for you.

If you are in a workspace somebody else owns, some of what you wrote lives in their workspace too. Tell us either way and we will explain exactly what can be removed and what belongs to the workspace.

Settings → Account → Delete my account, or email support@bullpen.chat from the address on the account. Either way we delete the account itself, and here is what that does — checked against the database rather than described in the abstract:

• Your profile is removed: your email address, your username, your display name and your sign-in.
• Your authored message text is removed. We replace it with a deleted-message placeholder and detach your identity. This preserves other people's replies without keeping your text. Your polls, scheduled messages, reminders and recurring AI helper instructions are removed too. Citation excerpts pointing at your deleted messages and public share links to those messages are removed.
• Your reactions, read markers, push subscriptions and the file-attachment records you uploaded go with the profile. Their file keys and your current uploaded profile photo are queued for removal in the deletion transaction. Cleanup removes the bytes afterwards and retries failures. Previously issued file links may work until the stored file is removed or the link expires.
• Usage rows stop naming you. The workspace keeps what it was billed for; the row no longer says who it was for. Same for a note-taking session you started: the notes stay with the workspace, the starter is detached.
• Ace is cancelled, its note about you is deleted, and its usage rows stop naming you. Unlike a workspace's subscription, it belongs to you, so deleting your account cancels it. Your conversations with it, the list of places it looked for each answer, and its settings are deleted too.
• You are no longer a member of anything.
• Reports other people made about your messages stay with the bullpen they were made in: the reason, the reporter's own words and the first reading's opinion. Your message itself is removed like the rest of your writing.
• Messages an AI helper wrote stay with the bullpen, even when they name you — a standup digest or a Friday recap, for example.
• The security log keeps a record of the deletion. That row holds your account id, the bullpens deleted with it, a shortened network address, the device and the city or region. It does not hold your email address or your username. Other rows about things you did stay too, no longer linked to your profile, with what they were written with — a row about changing your username keeps the old and the new username, and a row about a bullpen keeps its name. See what we collect.
• Your acceptance records stay. The record of which Terms and Privacy versions the account agreed to is kept on purpose; it holds a hash of your email, not the address, which someone who already knows the address can match.

What happens to a workspace you own, said out loud because a policy that leaves it out is misleading. If other people are in it, we do not delete your account until you have handed it over — a workspace with no owner is one nobody can rename, invite into or close. If you are the only person in it, it is deleted with you and its subscription is cancelled at the same moment, immediately, and the unused part of the paid period is not refunded.

And deletion does not rewrite what other people wrote: if a teammate typed your name in their own message, that is their message, and it stays. Nor does it empty a direct-message conversation you were part of — the other person's half is theirs, and their side of the thread stays where they can read it.

Deletion is permanent. There is no undo and no thirty-day grace period in which we could bring it back.

• Every table has row-level security on it, so the database itself enforces that you only read your own workspaces.
• The privileged database key never reaches a browser and is only used inside routes that have already checked who you are and what role you hold.
• The recording and attachment buckets are private. Files are read with a signed request; there is no public URL to leak, and the upload allowlist keeps out the file types that would run as script on somebody else's screen.
• Sessions live in cookies set by our auth provider, and the first-run cookie is marked so that page scripts cannot read it at all. Bullpen refuses to be embedded in a frame, and workspace ids are kept out of the referrer header so they do not ride along on an outbound click.

None of that makes a system perfect, and we are not going to claim it does. If you find a hole, email support@bullpen.chat and we will treat it as urgent. If a breach ever affects your data, we will tell you and the regulators the law names, without waiting to be asked.

Bullpen is a workplace tool for adults. It is not for anyone under 13, and we do not knowingly collect anything from a child. Signing up asks you to confirm you are 13 or older. If you believe a child has an account, email support@bullpen.chat and we will delete it.

When what we do changes, this page changes, and the version and date at the top change with it. This is version 2.20. If a change materially affects you — a new subprocessor, a new category of data, a change to how recording works — we will say so in the product or by email rather than editing quietly.

The company responsible for your data — the controller, in the language of privacy law — is Bullpen Chat LLC, a New Jersey limited liability company, United States.

Privacy questions, export and deletion requests, or a sentence on this page that does not match what the product does: support@bullpen.chat.

The rules for using Bullpen are on the Terms page.